3 ms·
This happens to many small business sites. If they leave their WordPress un-patched, or have a crappy plugin installed with security holes, or their FTP info i
by dpcan 13y ago
This happens to many small business sites.
If they leave their WordPress un-patched, or have a crappy plugin installed with security holes, or their FTP info is guessed, etc, hackers drop some malicious Javascript on their sites, and the next thing you know, their site cannot be accessed in Chrome, and usually Firefox as well. Depending on what services pick-up on the bad javascript.
For me, it usually takes a day(ish) from the time we are notified of the issue, update the sites, remove the malware, install webmaster tools from Google, submit and wait for the review to be unblocked.
On one hand, this is very frustrating, but on the other hand, many small businesses would have no idea their site had been hacked without it being blocked.
The only thing I'd like to see personally is if Google were somehow able to notify the domain registrant of the block via email so they find out right away, and not after a few weeks (or longer) in some cases. Some small business owners don't check their sites very often. We like to monitor our client sites, but sometimes new clients come to us with these problems and have no idea how long they've been down.
- dannyr 13y agoI connected my site to Google's Webmaster Tools. I get notified via email when Google finds any issues on my site.
- dpcan 13y agoYes, but they still block websites that are not connected to Google Webmaster Tools, and the site owners may not realize it. It would be nice if they notified the domain registrant as a heads-up because most small biz site owners that find their way to me may have sites that were designed years ago that need little to no maintaining, so they don't know they've been blocked as they barely ever look at their own sites.
- Matt_Cutts 13y agoWe explored trying to email whois contacts or standard addresses (such as webmaster@example.com or postmaster@example.com) and essentially got zero pickup. That's one of the reasons we provide Webmaster Tools, and so far it's our best channel to notify small business owners. We can sometimes label sites as hacked in the search results, but Webmaster Tools is definitely the preferred channel for communication of stuff like this.
- x3c 13y agoThanks for the clarification, Matt. Does such an action from google also include penalizing the website in terms of page rank and search rankings?
- Matt_Cutts 13y agoYes, but it varies, because we have automatic malware detection, automatic hacked site detection, and manual hacked site detection. For example, if we manually detect that a subdirectory of a site is hacked, we may remove only that subdirectory from our search results. If your entire site is hacked, then your entire site may be demoted or removed until the site is clean.
- larrys 13y ago"We explored trying to email whois contacts or standard addresses" Ironic since the original reason for the tech contact was exactly to be notified for issues like this. Would like to add that as a registrar though we get a reasonably good response to emails that we send. [1] Perhaps there is something about getting an email from google that says "it's probably spam". Or any large well known company that is often the subject of spam attempts. Even given that though it's hard for me to believe that the results were close to zero. [1] We also find that when a domain is deleted for non payment the person frequently claims they received no email notice but then proceeds to make some reference to something that was on the email notice.
- Matt_Cutts 13y agoMan, we could talk about this for hours. There's a lot of nuances involved in trying to alert site owners to issues, especially at a large scale. We've tried about 6-7 approaches over the years, and I'm still not completely happy with where we are. Freehosts are especially tough (WordPress, Blogger, etc.) because whois would just never work there.
- deleted 13y ago[deleted]